Fix parameters of accessforbidden

Dolibarr · Jun 4, 2019 · 969e139 · 969e139
1 parent 2c04a48
commit 969e139
Show file tree

Hide file tree

Showing 12 changed files with 18 additions and 105 deletions.
diff --git a/htdocs/asset/document.php b/htdocs/asset/document.php
@@ -145,7 +145,7 @@
 }
 else
 {
-	accessforbidden('', 0, 0);
+	accessforbidden('', 0, 1);
 }
 
 // End of page

diff --git a/htdocs/bom/bom_document.php b/htdocs/bom/bom_document.php
@@ -143,7 +143,7 @@
 }
 else
 {
-	accessforbidden('', 0, 0);
+	accessforbidden('', 0, 1);
 }
 
 // End of page

diff --git a/htdocs/compta/facture/card.php b/htdocs/compta/facture/card.php
@@ -3382,7 +3382,9 @@
 	$extralabels = $extrafields->fetch_name_optionals_label($object->table_element);
 
 	if ($user->societe_id > 0 && $user->societe_id != $object->socid)
-		accessforbidden('', 0);
+	{
+		accessforbidden('', 0, 1);
+	}
 
 	$result = $object->fetch_thirdparty();
 

diff --git a/htdocs/modulebuilder/template/myobject_document.php b/htdocs/modulebuilder/template/myobject_document.php
@@ -158,7 +158,7 @@
 }
 else
 {
-	accessforbidden('', 0, 0);
+	accessforbidden('', 0, 1);
 }
 
 // End of page

diff --git a/htdocs/public/ifttt/index.php b/htdocs/public/ifttt/index.php
diff --git a/htdocs/public/opensurvey/studs.php b/htdocs/public/opensurvey/studs.php
@@ -62,7 +62,7 @@
 // Add comment
 if (GETPOST('ajoutcomment', 'alpha'))
 {
-	if (!$canbemodified) accessforbidden();
+	if (!$canbemodified) accessforbidden('', 0, 0, 1);
 
 	$error=0;
 
@@ -97,7 +97,7 @@
 // Add vote
 if (GETPOST("boutonp") || GETPOST("boutonp.x") || GETPOST("boutonp_x"))		// boutonp for chrome, boutonp_x for firefox
 {
-	if (!$canbemodified) accessforbidden();
+	if (!$canbemodified) accessforbidden('', 0, 0, 1);
 
 	//Si le nom est bien entré
 	if (GETPOST('nom', 'nohtml'))
@@ -220,7 +220,7 @@
 		}
 	}
 
-	if (!$canbemodified) accessforbidden();
+	if (!$canbemodified) accessforbidden('', 0, 0, 1);
 
 	$idtomodify=$_POST["idtomodify".$modifier];
 	$sql = 'UPDATE '.MAIN_DB_PREFIX."opensurvey_user_studs";
@@ -235,7 +235,7 @@
 $idcomment=GETPOST('deletecomment', 'int');
 if ($idcomment)
 {
-	if (!$canbemodified) accessforbidden();
+	if (!$canbemodified) accessforbidden('', 0, 0, 1);
 
 	$resql = $object->deleteComment($idcomment);
 }

diff --git a/htdocs/resource/card.php b/htdocs/resource/card.php
@@ -237,8 +237,7 @@
 
 	if ($action == 'create' || $action == 'edit')
 	{
-		if ( ! $user->rights->resource->write )
-			accessforbidden('', 0);
+		if (! $user->rights->resource->write) accessforbidden('', 0, 1);
 
 		// Create/Edit object
 

diff --git a/htdocs/ticket/agenda.php b/htdocs/ticket/agenda.php
@@ -86,11 +86,11 @@
 // restrict access for externals users
 if ($user->societe_id > 0 && ($object->fk_soc != $user->societe_id))
 {
-	accessforbidden('', 0);
+	accessforbidden();
 }
 // or for unauthorized internals users
 if (!$user->societe_id && ($conf->global->TICKET_LIMIT_VIEW_ASSIGNED_ONLY && $object->fk_user_assign != $user->id) && !$user->rights->ticket->manage) {
-	accessforbidden('', 0);
+	accessforbidden();
 }
 
 

diff --git a/htdocs/ticket/card.php b/htdocs/ticket/card.php
@@ -647,7 +647,7 @@
     {
         // or for unauthorized internals users
         if (!$user->societe_id && ($conf->global->TICKET_LIMIT_VIEW_ASSIGNED_ONLY && $object->fk_user_assign != $user->id) && !$user->rights->ticket->manage) {
-            accessforbidden('', 0);
+            accessforbidden('', 0, 1);
         }
 
         // Confirmation close

diff --git a/htdocs/ticket/document.php b/htdocs/ticket/document.php
@@ -196,7 +196,7 @@
 }
 else
 {
-    accessforbidden('', 0, 0);
+    accessforbidden('', 0, 1);
 }
 
 // End of page

diff --git a/htdocs/user/document.php b/htdocs/user/document.php
@@ -174,7 +174,7 @@
 }
 else
 {
-	accessforbidden('', 0, 0);
+	accessforbidden('', 0, 1);
 }
 
 // End of page

diff --git a/htdocs/viewimage.php b/htdocs/viewimage.php
@@ -170,7 +170,7 @@ function llxFooter()
 else $type=dol_mimetype($original_file);
 
 // Security: This wrapper is for images. We do not allow type/html
-if (preg_match('/html/', $type)) accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.', 1, 1, 1);
+if (preg_match('/html/', $type)) accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.', 0, 0, 1);
 
 // Security: Delete string ../ into $original_file
 $original_file = str_replace("../", "/", $original_file);
@@ -179,7 +179,7 @@ function llxFooter()
 $refname=basename(dirname($original_file)."/");
 
 // Security check
-if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart', 1, 1, 1);
+if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart', 0, 0, 1);
 
 $check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $refname);
 $accessallowed              = $check_access['accessallowed'];